AML/KYC Compliance & Enforcement

This guidance document provides a comparative analysis of anti-money laundering (AML), know-your-customer (KYC), and compliance enforcement frameworks applicable to non-fungible tokens (NFTs) across 20 jurisdictions. It is intended for regulators, legal practitioners, and financial institutions seeking to understand the current state of NFT-related AML/KYC obligations, to map the global enforcement record, and to identify effective regulatory approaches.

1. Global Landscape — AML Models for NFTs

1.1 The Regulatory Spectrum

Jurisdictions have adopted four distinct models for applying AML/KYC obligations to NFTs. These models are not mutually exclusive; several jurisdictions employ hybrid approaches that combine elements from more than one model.

Model A — Full VASP Coverage NFTs classified as virtual assets subject platforms to full AML/KYC obligations identical to those for fungible crypto-assets. This model applies primarily where NFTs are deemed fungible in substance, fractionalized, or used for payment or investment purposes.

• South Korea: NFTs classified as virtual assets under FSC guidelines (June 2024) trigger full VASP registration with KoFIU, ISMS certification, real-name bank account requirements, Travel Rule compliance, and suspicious transaction reporting.
• EU: NFTs falling within MiCA scope (non-exempt, fractionalized, or large-series tokens) subject CASPs to the full AMLR 2024/1624 framework effective 10 July 2027.

Model B — Art/High-Value Dealer Rules NFT transactions are captured through existing high-value goods or art market AML frameworks, applying obligations at defined monetary thresholds rather than through crypto-specific regulation.

• EU: AMLR 2024/1624 extends AML obligations to dealers in cultural goods for transactions at or above EUR 10,000, potentially capturing high-value NFT art sales even where the NFTs are exempt from MiCA as unique collectibles.
• UK: Art market participant (AMP) registration with HMRC under MLR 2017 applies to transactions of EUR 10,000 or more (transitioning to GBP 10,000 in approximately May/June 2026). Whether NFTs constitute "works of art" for AMP purposes remains formally unconfirmed.
• Germany and
  France: Art dealers/intermediaries are obliged entities at EUR 10,000+ under the GwG (Germany) and AMLD5 transposition (France), supplementing the CASP route for high-value NFT art.

Model C — Threshold-Based / Conditional Coverage AML obligations apply only when NFTs meet specific functional criteria (payment or investment use) or exceed defined thresholds. Most jurisdictions default to this model for unique collectible NFTs.

• US: No NFT-specific FinCEN guidance. The March 2026 SEC/CFTC joint taxonomy classifies "digital collectibles" as neither securities nor commodities, but the Art Market Integrity Act (S.2400, proposed July 2025) would impose BSA obligations on art dealers for transactions over $10,000 and entities with annual sales exceeding $50,000.
• India: NFT marketplaces performing covered VDA activities are reporting entities under the PMLA (notification 7 March 2023) requiring FIU-IND registration, but pure collectibles are otherwise "taxed but unregulated" — no AML obligation attaches to genuinely unique, non-financialized collectibles.
• FATF: The October 2021 Updated Guidance (paragraphs 50-53) generally excludes unique collectible NFTs from the virtual asset definition but reclassifies them as VAs if used for payment or investment purposes in practice — a substance-over-form test adopted by most jurisdictions.

Model D — No Specific AML Requirements NFTs that are genuinely unique, non-fungible, and used as collectibles are not subject to AML/KYC obligations. General criminal law (anti-fraud, proceeds of crime) still applies.

• Singapore: Pure-collectible NFTs outside MAS's PSA and SFA perimeters have no direct AML obligations, though general CDSA criminal liability applies.
• Japan: NFTs without payment functionality are generally excluded from APTCP AML obligations, though industry self-regulatory bodies (JCBA, JVCEA) recommend voluntary AML/KYC measures.
• South Africa: Pure NFTs are unconditionally and indefinitely exempt from FAIS licensing (FAIS Notice 25 of 2023); an NFT-only business is not automatically a CASP accountable institution under FICA, though POCA money-laundering offences apply regardless of licensing.

Outside all four models — Controlled-Issuance Prohibition.

1.2 The FATF Foundation

The FATF Updated Guidance for a Risk-Based Approach to Virtual Assets and VASPs (October 2021) provides the global baseline. Paragraphs 50-53 establish:

1. NFTs that are "unique rather than interchangeable" and "used in practice as collectibles" are generally not virtual assets under the FATF definition.
2. NFTs become virtual assets if used for payment or investment purposes in practice, regardless of label.
3. Countries must consider "the nature of the NFT and applicable regulations" using a substance-over-form analysis.
4. Fractionalized NFTs that create fungible investment units likely meet the VA definition.

As of the June 2025 Targeted Update, only 29% of jurisdictions (40 of 138 assessed) were largely compliant with Recommendation 15, and 85 of 117 jurisdictions (73%) had enacted Travel Rule legislation. NFT-specific AML/CFT rules remain rare. Among the 20 jurisdictions surveyed here, every one applies the FATF substance-over-form test in some form, but only South Korea, Japan, the EU, Brazil and a handful of others have operative Travel Rule thresholds that would bite on NFT-classified virtual assets.

Sources:

• FATF Updated Guidance (October 2021)
• FATF 2025 Targeted Update
• Skadden — FATF Updates Global Guidelines

2. Comparative Analysis

2.1 Jurisdiction-by-Jurisdiction AML/KYC Obligations

2.2 Key Observations

Travel Rule implementation is the clearest differentiator. Japan stands alone in applying the Travel Rule to all crypto-asset transfers with no minimum threshold. South Korea sets a relatively low threshold of KRW 1 million (~USD 750). Brazil phases in a falling threshold (BRL 10,000 from Feb 2026, BRL 1,000 from Feb 2027). Canada applies a CAD 1,000 threshold; the EU and France apply a EUR 1,000 threshold for self-hosted address verification. The US has not extended Travel Rule requirements to NFTs, and China's secondary-trading ban means no Travel Rule operates on NFT transfers at all.

The "art dealer" pathway is emerging as a critical regulatory channel. The EU (AMLR cultural goods dealer provisions), the UK (AMP regime under MLR 2017), Germany and France (art dealers obliged at EUR 10,000+ under the GwG and AMLD5 transposition) all impose AML obligations on persons dealing in art above EUR/GBP 10,000. The US Art Market Integrity Act (S.2400) proposes a parallel $10,000 threshold. This pathway captures high-value NFT art transactions even where the NFTs are exempt from crypto-specific regulation.

Real-name and exclusionary architectures create the strongest — or most restrictive — KYC infrastructure. South Korea's three-way real-name verification chain (user, VASP, bank) makes anonymous virtual asset trading with Korean Won functionally impossible at registered exchanges. China goes further, requiring real-name authentication of every participant inside a closed, RMB-only channel with no secondary market. Thailand achieves a similar effect structurally: by barring NFTs from licensed exchanges since June 2021, it keeps most NFT trading outside the AML-supervised perimeter rather than inside a heavily-verified one.

A large bloc has no NFT-specific AML rules at all. Pure-collectible NFTs carry no direct AML obligation in Singapore, Japan (non-payment NFTs), South Africa (express FAIS exemption), Liechtenstein and Switzerland (unique art NFTs generally not subordinated), and — for genuinely unique, non-financialized collectibles — India. The common thread is reliance on general anti-fraud / proceeds-of-crime law plus a substance-over-form trigger that pulls in any NFT used for payment or investment.

Sources:

• EU AMLR 2024/1624
• Congress.gov — S.2400 Art Market Integrity Act
• DLA Piper — Art Market Integrity Act
• Notabene — Travel Rule in Japan
• Notabene — Travel Rule in South Korea
• GOV.UK — Money laundering supervision for art market participants

3. What Works and What Doesn't — Evidence from Enforcement

3.1 Enforcement Actions and Outcomes

NFT-specific AML/KYC enforcement remains in its early stages globally. Across all 20 jurisdictions surveyed, no regulator has publicly reported an AML/KYC enforcement action specifically targeting an NFT platform operator as of June 2026. Most enforcement activity has occurred in the securities, consumer protection, IP, and broader-crypto AML domains rather than NFT-specific AML/KYC. The evidence base is drawn from regulatory actions, risk assessments, and industry compliance data.

US: Treasury Risk Assessment (2024) — The Diagnostic Without a Cure

On 29 May 2024, the US Department of the Treasury published the first-ever Illicit Finance Risk Assessment of Non-Fungible Tokens, identifying key vulnerabilities:

• Self-laundering: Criminals purchasing NFTs with illicit funds and transacting with themselves to create artificial blockchain sales records
• Wash trading: Artificially inflating NFT prices to obscure illicit fund origins
• Inadequate platform controls: Gaps in AML screening, cybersecurity, and sanctions compliance at NFT marketplaces
• Fraud and scams: NFTs are "highly susceptible" to fraud, with counterfeit sales and smart contract exploitation

The assessment found limited evidence of terrorist financing or proliferation financing through NFTs, but flagged money laundering as a "significant concern." Critically, this risk assessment has not been followed by binding regulation — FinCEN has issued no NFT-specific rules as of June 2026.

The earlier 2022 Treasury Study on Illicit Finance in the High-Value Art Market had already identified NFTs as an emerging risk vector, noting that NFTs can be "transferred via the internet without concern for geographic distance and across borders nearly instantaneously."

Sources:

• US Treasury — NFT Illicit Finance Risk Assessment (May 2024)
• US Treasury — NFT Risk Assessment Full Report (PDF)
• BakerHostetler — Treasury NFT Risk Assessment Analysis

US: SEC Enforcement — Securities, Not AML; Now in Retreat

The SEC's three settled NFT enforcement actions (Impact Theory, August 2023, $6.1M, the first; Stoner Cats 2, September 2023, $1M; Flyfish Club, September 2024, $750K) targeted NFTs as unregistered securities, not as AML violations. Private litigation extended the picture: Dapper Labs ($4M settlement), DraftKings ($10M), and Yuga Labs v. Ripps ($8M+ on trademark grounds). These actions demonstrated that marketing NFTs as investments with profit expectations triggers securities law, but they did not establish AML/KYC precedent for NFT platforms.

The regulator's stance has since shifted sharply from aggressive enforcement (the Gensler era, 2021-2024) to a pro-innovation retreat under Executive Order 14178 and the SEC Crypto Task Force led by Commissioner Peirce. The SEC closed its OpenSea investigation (21 February 2025) and its Yuga Labs/BAYC investigation (3 March 2025) without charges. The March 2026 SEC/CFTC joint taxonomy classifying "digital collectibles" as neither securities nor commodities has substantially reduced securities enforcement risk for genuine NFT collectibles. The CFTC has taken no standalone NFT action. However, the AML gap identified by Treasury remains unaddressed, and state AGs (especially New York) are filling the federal gap — on 25 February 2026 NY AG James sued Valve (Steam) over loot-box/mystery-box mechanics as illegal gambling, a signal of potential expansion to NFT loot mechanics.

Sources:

• SEC — Crypto Asset Classification (March 2026)

Americas: Brazil and Canada — Broad-Crypto Enforcement, No NFT Actions

Asia-Pacific: Hong Kong, Australia, Singapore — Strong Track Records, No NFT Cases

South Korea: Systemic Enforcement Against Unregistered VASPs

South Korea has the most active enforcement posture among the surveyed jurisdictions:

• First VAUPA market-manipulation conviction (4-5 February 2026): a 3-year sentence, KRW 500M fine, and KRW 846M forfeiture handed down by the Seoul Southern District Court — the first conviction under the Virtual Asset User Protection Act's unfair-trading provisions (an investigation first announced November 2024).
• Unregistered VASP crackdown (March 2025): KoFIU moved to block unregistered exchange applications, including KuCoin and MEXC, via the Google Play Store.
• Five Stars for Klaytn (Seoul Administrative Court 2023): the court upheld GRAC's refusal to rate a blockchain game, reinforcing the de facto P2E/gaming-NFT ban under GIPA.
• Supreme Court Bitcoin seizure ruling (December 2025): cryptocurrency held on exchanges is subject to seizure under the Criminal Procedure Act — with implications for NFTs classified as virtual assets.

While these actions target the broader crypto ecosystem and gaming NFTs rather than NFT-AML specifically, they establish the enforcement infrastructure and precedent for future NFT-specific actions.

Sources:

• Shin & Kim — First VAUPA Market Manipulation Case
• BitCompare — South Korea Blocks Unregistered VASPs

China: Controlled-Issuance Enforcement and IP Precedent

China's enforcement is distinctive because it polices the financialization boundary rather than AML failures inside an open market. The landmark precedents are IP and "network virtual property" cases, not AML actions:

• Qice v. Bigverse (Hangzhou Internet Court, 2022): the first NFT infringement judgment (RMB 4,000), establishing that platforms owe a heightened prior-ownership review duty.
• Wang v. NFT platform (29 November 2022): Hangzhou Internet Court held that NFT collectibles are "network virtual property" protected by law.
• Platform self-policing under state pressure: WeChat shut more than 12 digital-collectible accounts (March 2022); Tencent's Huanhe platform halted issuance.
• SPP criminal-risk guidance (May 2023): the Supreme People's Procuratorate warned of illegal fundraising, fraud, and money-laundering risks (citing 59,700 complaints in 2022).

The regulator stance is restrictive — controlled-issuance / anti-financialization: state-channelled, anti-speculation, and aggressive in policing the line between a permitted collectible and a prohibited financial instrument. As of June 2026 no confirmed, fully operational, nationally sanctioned compliant secondary market has been established.

Thailand: Structural Exclusion, Not Litigation

Thailand has taken no SEC enforcement against a specific NFT issuer or marketplace (no data found). Its regulator stance toward NFT trading is preventive and structural rather than case-by-case: the Thai SEC's standing prohibition on listing NFTs at licensed exchanges (since 11 June 2021) keeps NFT trading out of the regulated perimeter, so there is little to litigate. Recent enforcement targets unlicensed activity generally — a 9 January 2026 Economic Crime Division (ECD) criminal complaint against five individuals (unlicensed dealer activity, Worldcoin), and a 20 February 2026 ECD complaint against a local licensed broker, an overseas platform, and executives for unlicensed exchange operation.

India: Fiscal and AML Pressure Without NFT-Specific Actions

India's posture is restrictive — "taxed but unregulated": fiscally punitive and AML-supervised, but substantively under-regulated at the market-conduct level. There is no enforcement against an NFT-only platform (no data found). AML enforcement has, however, been forceful at the VDA level: FIU-IND issued nine offshore VDA-SP show-cause notices and URL-blocking orders (December 2023), and imposed an ₹18.82 crore PMLA penalty on Binance (Order 10/DIR/FIU-IND/2024, 19 June 2024). A comprehensive crypto framework remains stalled.

EU: Enforcement Gap During Transition

As of June 2026, no EU national competent authority has publicly announced enforcement actions specifically targeting NFT marketplace operators for MiCA non-compliance or AML violations. This reflects:

1. MiCA full application commenced only on 30 December 2024
2. Transitional periods extend to 1 July 2026
3. The AMLR does not apply until 10 July 2027
4. AMLA commenced operations on 1 July 2025 but will not begin direct supervision of entities until 2028

The EU's approach is regulation-first: build the comprehensive framework (MiCA + AMLR + AMLA + TFR), then enforce. MiCA Article 111 sets fines for CASP infringements up to EUR 5M or 5% of turnover (legal persons) and EUR 700k (natural persons). The risk is that enforcement lag creates a window of non-compliance. Notably, on 20 May 2026 the European Commission opened a targeted MiCA review consultation expressly asking whether NFT-related service providers should be regulated (closing 31 August 2026).

Sources:

• AMLA — Official Operations Launch (July 2025)
• Jones Day — AMLA Investigatory Powers

France and Germany: Proactive Member-State Enforcement, No NFT Targets

Liechtenstein and Switzerland: Permissive, Event-Driven Supervision

UK: Advertising and Cross-Border Enforcement as AML Proxy

The UK's Advertising Standards Authority (ASA) has been the most active enforcer in the NFT space, with rulings against FC Barcelona (December 2022, upheld as misleading), Floki Inu (March 2022, irresponsible crypto advertising), and Crypto.com. While these are not AML actions, they demonstrate regulatory willingness to act (the ASA placed crypto/NFT ads on "red alert"; 413 promotion cases by August 2024).

The FCA's High Court proceedings against HTX (Huobi) for illegal financial promotions (commenced 21 October 2025; continued 10 February 2026) — the first FCA action against an offshore cryptoasset exchange — signals that the FCA will pursue cross-border enforcement and reserves the ability to expand its perimeter to NFTs if warranted. However, no FCA enforcement action has specifically targeted NFT platforms for AML non-compliance. The UK AMP regime under MLR 2017 requires HMRC registration for art transactions above EUR 10,000, but whether NFTs qualify as "works of art" remains formally unresolved, creating an enforcement gap.

Sources:

• ASA — FC Barcelona Ruling (A22-1162954)
• Freeths — FCA High Court Action Against HTX

Middle East & Africa: VARA's Active Posture vs. Supervisory Models

Japan: Self-Regulatory Model

Japan's enforcement model relies heavily on FSA supervisory oversight of registered CAESPs combined with industry self-regulation through the JVCEA and JCBA. No landmark NFT-specific case exists; the broader precedents are the Coincheck hack (2018), the Mt. Gox bankruptcy (2014), and unregistered-exchange warnings (Binance, Bybit). The Consumer Affairs Agency enforces gacha/Premiums Act rules, but no NFT-gacha prosecutions have been publicised. The FSA issues supervisory orders and inspections, and the Travel Rule (enforced since June 2023 with no minimum threshold) is one of the strictest globally — though its application to NFTs depends on whether the NFT is classified as a crypto-asset.

Sources:

• Shyft Network — Japan Travel Rule Enforcement

3.2 What Works

1. Substance-over-form classification. The FATF functional test — adopted in some form by all 20 surveyed jurisdictions, and most explicitly by the EU, UK, Japan, South Korea, Singapore, Switzerland, and South Africa — correctly identifies that the regulatory treatment of an NFT should depend on its economic function, not its label. This approach prevents regulatory arbitrage through creative labelling.

2. Dual-track AML coverage (crypto + art dealer). The EU, Germany, and France apply AML obligations through both the CASP framework (for NFTs within MiCA scope) and the cultural goods / art dealer framework (for high-value NFT art above EUR 10,000), closing the gap that exists in jurisdictions with only crypto-specific regulation.

3. Real-name verification systems. South Korea's three-way bank verification chain eliminates anonymous fiat-to-crypto transactions at registered exchanges. While restrictive, it has produced the most effective KYC infrastructure in the open NFT market. China achieves total participant identification, but only by suppressing the secondary market entirely.

4. Proactive risk assessment. The US Treasury's 2024 NFT Illicit Finance Risk Assessment provides the most comprehensive analysis of NFT ML/TF vulnerabilities globally, offering a model for other jurisdictions.

5. Self-regulatory industry guidance. Japan's JCBA NFT Business Guidelines and BCA Guidelines, and China's industry self-regulation conventions (Tencent/JD/Alibaba and the ~30-institution 2023 initiative), provide practical compliance frameworks that supplement statutory requirements — though China's are deployed in service of a prohibition-leaning posture rather than market facilitation.

3.3 What Doesn't Work

1. Regulation without enforcement. The EU has built the world's most comprehensive AML framework for digital assets (MiCA + AMLR + AMLA + TFR), but as of June 2026 no enforcement actions have been taken against NFT platforms. Regulatory credibility requires timely enforcement.

2. Risk assessment without rulemaking. The US Treasury identified NFT money-laundering risks in both 2022 (art market study) and 2024 (NFT risk assessment), but FinCEN has not issued any NFT-specific rules, and the proposed Art Market Integrity Act (S.2400) remains unlegislated. Diagnosis without prescription leaves the vulnerability open. India presents a parallel failure: an aggressive tax-and-AML overlay sits atop an enduring market-conduct vacuum ("taxed but unregulated").

3. Ambiguous classification boundaries. The UK's failure to formally determine whether NFTs are "works of art" for AMP purposes, the EU's lack of a numerical "large series" threshold, and India's unresolved SEBI treatment of fractionalized/yield-bearing NFTs create zones of regulatory uncertainty that sophisticated actors can exploit.

4. Platform-only regulation. Regulating NFT platforms (VASPs, CASPs) while leaving peer-to-peer NFT transfers unaddressed creates the same regulatory gap identified by the FATF for P2P crypto transfers. High-value NFTs can be transferred directly between wallets without triggering any AML controls.

5. Excessive or exclusionary compliance barriers. South Korea's ISMS certification (6-8 months, 104 control items across 16 domains) and real-name bank account requirements produced only 28 registered VASPs as of April 2025, with just 5 exchanges holding verified real-name bank accounts — effectively excluding smaller and international NFT platforms. Thailand's outright listing ban and China's secondary-trading suppression go further still: they protect against on-platform laundering by eliminating the regulated market, but at the cost of driving activity into informal or offshore channels where no AML supervision applies.

4. Recommended Framework

4.1 Principles

An effective AML/KYC framework for NFTs should be built on six principles:

1. Substance over form: Classification must be based on the economic function of the NFT, not its label, technical implementation, or marketing designation — consistent with the FATF functional test.

2. Proportionality: Obligations should be calibrated to risk. A $50 gaming NFT does not present the same ML/TF risk as a $500,000 digital artwork. Threshold-based obligations prevent disproportionate compliance burdens on low-risk transactions.

3. Dual-track coverage: AML obligations should apply through both crypto-specific regulation (for NFTs meeting the VA/crypto-asset definition) and art/high-value goods regulation (for high-value NFT art and collectibles). This ensures no regulatory gap between the two regimes.

4. Technology neutrality: The regulatory treatment of an NFT transaction should not differ from the treatment of a functionally equivalent traditional transaction. A $100,000 digital artwork sale should trigger the same AML obligations as a $100,000 physical artwork sale.

5. International coordination: NFTs are inherently cross-border. Effective regulation requires consistent implementation of FATF standards, mutual recognition of compliance regimes, and information-sharing mechanisms between national FIUs.

6. Enforcement credibility: Rules without enforcement are advisory. Regulators must demonstrate willingness and capacity to take action against non-compliant NFT platforms — and should avoid substituting blanket exclusion (the Thailand/China route) for supervised, risk-based market access.

4.2 Recommended Obligations by NFT Category

4.3 Recommended Institutional Arrangements

Supervisory architecture: Jurisdictions should designate a single primary AML supervisor for NFT platforms to avoid fragmented oversight. The EU model (AMLA as coordinating body with national competent authorities) provides a workable template for multi-jurisdictional coordination; conversely, the multi-regulator dispersion seen in the US, UAE, India, and China illustrates the coordination cost of fragmented mandates.

FIU capacity: National Financial Intelligence Units should develop NFT-specific analytical capabilities, including blockchain analytics tools, to process suspicious transaction reports involving NFT transfers. JAFIC (Japan), KoFIU (South Korea), COAF (Brazil), and FIU-IND (India) offer models for integrating crypto-asset intelligence into existing FIU operations.

Industry engagement: Self-regulatory organizations (SROs) such as Japan's JVCEA and JCBA, and Switzerland's AML SROs (VQF, PolyReg, SO-FIT, ARIF), provide effective intermediaries between regulators and industry. Jurisdictions should encourage SRO development while maintaining statutory enforcement authority.

Cross-border cooperation: Regulators should establish bilateral and multilateral information-sharing arrangements specifically covering NFT-related suspicious activity. The FATF Egmont Group framework for FIU cooperation provides the existing infrastructure; the UAE's CMA-VARA mutual recognition agreement (August 2025) is a useful intra-jurisdictional precedent.

4.4 Implementation Priorities

Immediate (0-12 months):

• Formal determination of whether NFTs constitute "works of art" or "cultural goods" under existing art dealer AML frameworks (addressing the UK AMP classification gap)
• Publication of NFT-specific AML guidance by financial intelligence units (addressing the US FinCEN gap and the absence of NFT-specific AML guidance flagged in Thailand)
• Establishment of NFT-focused typologies and red flag indicators for suspicious transaction identification

Medium-term (12-24 months):

• Enactment of art market AML legislation where absent (US Art Market Integrity Act or equivalent)
• Integration of NFT transaction monitoring into existing VASP/CASP supervisory frameworks
• Development of international NFT transaction data-sharing protocols between FIUs

Long-term (24-36 months):

• Assessment of P2P NFT transfer risks and development of proportionate regulatory responses
• Alignment of national NFT AML frameworks with evolving FATF guidance
• Evaluation of smart contract-based compliance tools (automated CDD, sanctions screening, Travel Rule messaging)

5. Decision Matrix

5.1 Regulatory Classification Decision Tree

The following decision matrix assists regulators in determining the appropriate AML/KYC obligations for any given NFT activity.

START
│
├─ Q1: Is the NFT used for payment or investment purposes in practice?
│   ├─ YES → Classify as virtual asset / crypto-asset
│   │   ├─ Q2: Does the NFT qualify as a security under national law?
│   │   │   ├─ YES → Apply securities AML framework (e.g., MiFID II, FSCMA, FIEA)
│   │   │   └─ NO → Apply VASP/CASP AML framework (full CDD, Travel Rule, STR)
│   │   └─ [END: Full AML obligations apply]
│   │
│   └─ NO → Continue to Q3
│
├─ Q3: Is the NFT fractionalized into fungible units?
│   ├─ YES → Treat fractional units as virtual assets / securities
│   │   └─ Apply full VASP/CASP or securities AML framework
│   │   └─ [END: Full AML obligations apply]
│   │
│   └─ NO → Continue to Q4
│
├─ Q4: Is the NFT part of a large series with interchangeable characteristics?
│   ├─ YES → Assess substance: do members have homogeneous rights/utility?
│   │   ├─ YES → Classify as virtual asset (fungible in substance)
│   │   │   └─ Apply VASP/CASP AML framework
│   │   └─ NO → Continue to Q5
│   │
│   └─ NO → Continue to Q5
│
├─ Q5: Does the transaction value exceed EUR/USD 10,000?
│   ├─ YES → Apply art dealer / high-value goods AML framework
│   │   └─ Standard CDD, STR obligations, record keeping
│   │   └─ [END: Threshold-based AML obligations apply]
│   │
│   └─ NO → Continue to Q6
│
└─ Q6: Is the NFT genuinely unique, used as a collectible, and below threshold?
    ├─ YES → No mandatory financial AML obligations
    │   └─ General anti-fraud and proceeds-of-crime laws apply
    │   └─ Voluntary AML/KYC recommended as best practice
    │   └─ [END: No specific AML obligations]
    │
    └─ UNCERTAIN → Apply risk-based assessment; seek regulatory guidance

Jurisdiction-specific override. In a small number of jurisdictions the tree above is pre-empted by a structural rule. In China, secondary trading and resale of digital collectibles are banned in practice, so the VASP-transfer branches do not operate; AML compliance is delivered instead through mandatory real-name authentication of every participant at primary issuance. In Thailand, NFTs cannot be listed on licensed digital-asset exchanges (since June 2021), so most NFT activity falls outside the AML-supervised perimeter regardless of where it lands in the tree. In South Africa, pure NFTs are expressly FAIS-exempt, so an NFT-only platform reaches Q6's "no specific AML obligations" outcome by statute.

5.2 Platform Compliance Decision Matrix

5.3 Risk Indicator Checklist for NFT Transactions

Regulators and compliance officers should monitor for the following red flag indicators, derived from the US Treasury 2024 NFT Risk Assessment, FATF guidance, and jurisdictional enforcement experience:

High-Risk Transaction Indicators:

• NFT purchased and resold within a short timeframe at significantly inflated prices (potential wash trading / self-laundering)
• Multiple high-value NFT purchases by a single wallet with no prior transaction history
• NFT transactions funded by privacy coins, mixing services, or cross-chain bridges
• NFTs transferred through multiple wallets in rapid succession (layering)
• NFT transactions involving sanctioned jurisdictions or wallets flagged by blockchain analytics
• NFT marketplace user declining to provide identity verification when requested
• Disproportionately high transaction values relative to stated user income or business profile
• NFT transactions structured to fall just below reporting thresholds (structuring / smurfing)

Platform-Level Risk Indicators:

• NFT platform operating without AML registration in any jurisdiction
• Platform permitting anonymous account creation for high-value transactions
• Platform lacking blockchain analytics or sanctions screening tools
• Platform experiencing high volumes of reported fraud or counterfeit NFTs
• Platform facilitating transactions in NFTs with opaque provenance or ownership history

6. Cross-References

• FATF — Updated Guidance paragraphs 50-53; Travel Rule (R.16); 2025 Targeted Update
• IOSCO — Policy Recommendations for Crypto and Digital Asset Markets (November 2023); "same activity, same risk, same regulation" principle
• US — Treasury 2024 NFT Risk Assessment; FinCEN MSB framework; Art Market Integrity Act (S.2400); SEC/CFTC five-category taxonomy (March 2026)
• Brazil — Law 14,478/2022 (BVAL); BCB Resolution 520 Travel Rule; COAF FIU; SPSAV authorization
• Canada — PCMLTFA / FINTRAC MSB regime; CSA substance-over-form guidance; CIRO custody framework
• EU — AMLR 2024/1624; MiCA CASP framework; TFR Travel Rule; AMLA; AMLD6
• France — CMF CASP regime; Tracfin FIU; art-dealer AML at EUR 10,000+; JONUM/ANJ gaming regime
• Germany — GwG; BaFin CASP supervision; art-dealer AML; FG Niedersachsen NFT VAT case
• Liechtenstein — SPG; TVTG TT Service Provider registration; CASP authorization
• Switzerland — AMLA/GwG; FINMA + SRO-delegated supervision; MROS
• UK — MLR 2017; FCA cryptoasset registration; HMRC AMP regime; Cryptoassets Regulations 2026
• Hong Kong — AMLO Part 5B VASP regime; SFC licensing; JFIU STR reporting; JPEX/Hounax enforcement
• Australia — AML/CTF Act 2006 + 2024 Amendment; AUSTRAC DCE/VASP registration; ASIC INFO 225
• Japan — APTCP; JAFIC; JVCEA Travel Rule; CAESP registration; JCBA NFT Business Guidelines
• South Korea — VAUPA; ISTA/AML Act; KoFIU VASP registration; ISMS certification; real-name bank accounts
• China — Yin Fa [2021] No. 237 / [2026] No. 42; April 2022 three-association anti-financialization initiative; PBOC real-name AML; secondary-trading ban
• Thailand — Emergency Decree on Digital Asset Businesses 2018; AMLO; June 2021 exchange listing ban; SEC NFT guideline
• India — PMLA 2002 / FIU-IND; s.2(47A) VDA definition; ASCI advertising guidelines; Online Gaming Act 2025
• Bahrain — CBB Crypto-Asset Module; Financial Crimes Module; Travel Rule; Financial Intelligence Directorate
• UAE — VARA / ADGM FSRA / DFSA / CMA; Federal Decree-Law No. 20 of 2018 (AML/CFT); goAML FIU
• South Africa — FICA 2001; FIC Directive 9 Travel Rule; FAIS NFT exemption (Notice 25 of 2023); POCA
• securities classification — When NFTs cross from collectibles to securities under the Howey test, MiFID II, FIEA, or FSCMA
• marketplace regulation — Platform-level obligations for NFT marketplace operators

7. Verification Notes

Sources Verified (refresh 2026-06-04)

International frameworks:

• FATF October 2021 Updated Guidance: verified via FATF publication page; NFT provisions in paragraphs 50-53 corroborated through Skadden, Reed Smith, Norton Rose Fulbright, and Davis Polk analyses.
• FATF 2025 Targeted Update compliance statistics (29% R.15 compliance, 73% Travel Rule legislation): verified via FATF publication page.

United States:

• Treasury 2024 NFT Illicit Finance Risk Assessment: verified via Treasury press release (jy2382) and full report PDF.
• SEC NFT actions (Impact Theory, Stoner Cats 2, Flyfish Club), OpenSea and Yuga/BAYC investigation closures, EO 14178 / Crypto Task Force retreat, and NY AG v. Valve (25 Feb 2026): sourced from the fact matrix (t8).
• Art Market Integrity Act (S.2400): verified via Congress.gov, DLA Piper analysis, and Senator Grassley press release.
• SEC/CFTC March 2026 joint taxonomy: verified via SEC press release 2026-30 and CFTC press release 9198-26.

Americas (Brazil, Canada):

• Brazil — Law 14,478/2022, BCB Resolution 520 Travel Rule phases (BRL 10,000 / BRL 1,000), SPSAV 30 Oct 2026 deadline, and R$164M Goiás laundering operation (Jul 2025): sourced from the fact matrix (t5, t6, t8).
• Canada — PCMLTFA MSB status (since 1 Jun 2020), CAD 10,000 LVCTR / CAD 1,000 Travel Rule, FINTRAC 23-MSB revocation (17 Mar 2026), and AMF v. Gagnon (Aug 2025): sourced from the fact matrix (t5, t8).

European Union and Member States:

• AMLR (EU) 2024/1624: verified via EUR-Lex; EUR 10,000 cultural goods dealer threshold confirmed through DLA Piper and Deloitte Legal; application date 10 July 2027 confirmed.
• AMLA operations: verified via German Federal Ministry of Finance and AML Intelligence; 1 July 2025 launch date confirmed; direct supervision from 2028. EU Commission 20 May 2026 MiCA-review consultation on NFT service providers: sourced from the fact matrix (recent timeline).
• TFR (EU) 2023/1113: verified via EUR-Lex.
• France — AMF 2024 penalties (42, EUR 29.4M), 2025 blocklist of 66 platforms, 28 May 2026 Barbat-Layani warning, and Tracfin/ANJ structure: sourced from the fact matrix (t5, t8).
• Germany — GwG art-dealer obligation (EUR 10,000+), Ethena GmbH/USDe action (Mar-Apr 2025), and FG Niedersachsen 5 K 26/24 NFT VAT decision (10 Jul 2025, first-instance, not binding): sourced from the fact matrix (t5, t8).
• Liechtenstein (SPG / TVTG, no NFT-specific enforcement) and Switzerland (AMLA/GwG, 2024 investigation counts, May 2024 X Ltd cease-and-desist): sourced from the fact matrix (t5, t8).

United Kingdom:

• MLR 2017 AMP provisions: verified via GOV.UK; EUR 10,000 threshold confirmed; transition to GBP 10,000 confirmed via FCS Compliance.
• FCA HTX enforcement (High Court, 21 Oct 2025; continued 10 Feb 2026): verified via Freeths.
• NFT classification as "works of art" under AMP regime: NOT VERIFIED — no formal HMRC or government confirmation found.

Asia-Pacific:

• Australia — AUSTRAC DCE/VASP registration, AUD 10,000 threshold reports, AML/CTF Amendment Act 2024 Travel Rule, and Block Earner litigation: sourced from the fact matrix (t5, t8).
• Hong Kong — JPEX (Sep 2023) and Hounax (Nov 2023) enforcement; SFC Alert List: sourced from the fact matrix (t8).
• Japan — APTCP and JAFIC: verified via Ministry of Finance and Notabene; Travel Rule enforcement since June 2023: verified via Shyft Network.
• Singapore — MAS Notice PSN02: verified via MAS; DTSP framework (30 June 2025) via Gibson Dunn and Allen & Gledhill.
• South Korea — VASP registration, ISMS, real-name accounts: verified via Notabene, 21 Analytics, and Sumsub; first VAUPA market-manipulation conviction (4-5 Feb 2026, 3 yrs / KRW 500M fine / KRW 846M forfeiture): verified via Shin & Kim; 28 registered VASPs / 5 real-name exchanges (Apr 2025): sourced from Phase 1 country file, confirmed via Chambers — Blockchain 2025, South Korea.
• China — Yin Fa [2021] No. 237 and [2026] No. 42, April 2022 three-association initiative, real-name AML, secondary-trading ban, Qice v. Bigverse (2022) and Wang v. NFT platform (29 Nov 2022), and SPP May 2023 criminal-risk guidance: sourced from the fact matrix (t1, t5, t8). The distinctive model — primary issuance permitted via state-supervised RMB-only platforms, secondary trading/resale banned in practice — is reflected throughout.
• Thailand — June 2021 exchange listing ban, AMLO supervision of licensed operators, and ECD criminal complaints (9 Jan 2026, 20 Feb 2026): sourced from the fact matrix (t1, t5, t8). No SEC enforcement against a specific NFT issuer/marketplace: NO DATA FOUND.
• India — PMLA reporting-entity notification (7 Mar 2023), FIU-IND nine offshore show-cause notices (Dec 2023), and Binance ₹18.82 crore PMLA penalty (19 Jun 2024): sourced from the fact matrix (t5, t8). SEBI classification of NFTs: NOT VERIFIED.

Middle East & Africa:

• Bahrain — CBB Financial Crimes Module AML programme; supervisory (non-punitive) stance; no NFT-specific enforcement identified: sourced from the fact matrix (t5, t8).
• UAE — Federal Decree-Law No. 20 of 2018 AML/CFT; VARA fines on 19 unlicensed firms (7 Oct 2025) and 7 firms (Oct 2024); CMA penalty regime (Art. 65/71); CMA-VARA mutual recognition (Aug 2025): sourced from the fact matrix (t5, t6, t8).
• South Africa — FICA accountable-institution status (from 19 Dec 2022), FIC Directive 9 Travel Rule (compliance 30 Apr 2025), FAIS NFT exemption (Notice 25 of 2023), and FSCA fungible-crypto enforcement (81 investigations, 56 ongoing, Jan 2026): sourced from the fact matrix (t5, t6, t8). Any NFT-specific FSCA/FIC/court enforcement action: NO DATA FOUND.

Items Not Verified / Data Gaps

• NFT-specific AML enforcement actions globally: Across all 20 surveyed jurisdictions, no regulator has publicly reported an AML/KYC enforcement action specifically targeting an NFT platform operator as of June 2026.
• NFT wash trading prosecution: No jurisdiction has prosecuted wash trading specifically in NFTs, though the US Treasury 2024 assessment flagged it as a significant concern.
• UK AMP classification of NFTs: Whether NFTs qualify as "works of art" under the MLR 2017 AMP regime remains formally unresolved.
• EU "large series" threshold: Neither MiCA nor ESMA guidelines define a specific numerical threshold for when an NFT collection becomes a "large series" indicating fungibility.
• India SEBI / China licensing detail: SEBI has not classified NFTs as securities (NOT VERIFIED); China's digital-collectibles licensing stack capital/cost/timeline is NOT VERIFIED, and no nationally sanctioned compliant secondary market is confirmed operational as of June 2026.
• Thailand and South Africa NFT-AML specifics: No NFT-specific AML guidance exists in Thailand (NO DATA FOUND), and whether NFT-only marketplaces are FICA accountable institutions in South Africa is NOT VERIFIED.
• Global NFT-specific STR/SAR volumes: No FIU publicly reports the number of suspicious transaction reports specifically involving NFTs.